[BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir

[BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir

[Farhad Alemi]

[-- Attachment #1: Type: text/plain, Size: 4320 bytes --]

Hello Andreas and the configfs team,

I am reporting a configfs use-after-free found by syzkaller.

Summary:
A configfs config-item rmdir(2) can land in configfs_drop_dentry() with
sd->s_dentry pointing at a dentry whose RCU grace period has not yet
elapsed. The spin_lock(&dentry->d_lock) at fs/configfs/inode.c:209 then
reads freed slab memory and KASAN reports a slab-use-after-free.

The race is between an earlier openat path (via lookup_open ->
d_alloc_parallel) that allocates a child dentry, hits an error and
takes the dput()/__dentry_kill()/call_rcu() free path, and a later
rmdir on the same config item that walks the children via
detach_attrs() and grabs &dentry->d_lock before the RCU grace period
elapses.

Observed on:
- Linux v6.17.8 x86_64, QEMU Q35
- KASAN enabled; panic_on_warn set
- The only local dirty file in my tree is drivers/tty/serial/serial_core.c,
  containing a local ttyS0 console guard for the fuzzing harness. It is
  unrelated to fs/configfs/.
- Trigger does not require a crafted on-disk state; configfs is in-memory.
  However, the syz reproducer uses fault injection (CONFIG_FAULT_INJECTION)
  to force the openat error path on the Nth allocation. Without fault
  injection the race is plausibly still reachable but timing-dependent.

Impact:
A configfs config-item rmdir races with a still-pending dentry RCU free
and KASAN reports a UAF read in the spin_lock:

  BUG: KASAN: slab-use-after-free in __raw_spin_lock
include/linux/spinlock_api_smp.h:133 [inline]
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x33/0x40
kernel/locking/spinlock.c:154
  Read of size 1 at addr ffff888133d5a538 by task syz.2.275/4076

Allocator (openat path):

  __d_alloc+0x3b/0x7b0 fs/dcache.c:1690
  d_alloc_parallel+0xeb/0x1620 fs/dcache.c:2549
  lookup_open fs/namei.c:3638 [inline]
  open_last_lookups fs/namei.c:3815 [inline]
  path_openat+0xa6b/0x3890 fs/namei.c:4051
  do_filp_open+0x232/0x490 fs/namei.c:4081
  do_sys_openat2+0x134/0x1e0 fs/open.c:1437
  __x64_sys_openat+0x13d/0x170 fs/open.c:1463

Free path (RCU dput, softirq):

  kmem_cache_free+0x18f/0x3f0 mm/slub.c:4812
  rcu_do_batch kernel/rcu/tree.c:2605 [inline]
  rcu_core+0xd1e/0x1800 kernel/rcu/tree.c:2861

Crashing path (rmdir):

  _raw_spin_lock+0x33/0x40 kernel/locking/spinlock.c:154
  configfs_drop_dentry+0x5c/0x150 fs/configfs/inode.c:209
  detach_attrs+0x22b/0x2f0 fs/configfs/dir.c:588
  configfs_detach_item fs/configfs/dir.c:870 [inline]
  configfs_detach_group fs/configfs/dir.c:917 [inline]
  configfs_rmdir+0x652/0x9f0 fs/configfs/dir.c:1551
  vfs_rmdir+0x3c2/0x530 fs/namei.c:4469
  do_rmdir+0x275/0x540 fs/namei.c:4524
  __x64_sys_rmdir+0x4c/0x60 fs/namei.c:4541

Expected behavior:
configfs_drop_dentry()'s read of sd->s_dentry and the subsequent
spin_lock(&dentry->d_lock) need to be safe against a concurrent
RCU-deferred dentry free. Plausible directions: hold the parent's
i_lock around the sd->s_dentry read + spin_lock; rcu_read_lock() to
keep the slab from being recycled while we attempt to lock; or have
configfs hold an explicit reference on sd->s_dentry while it lives in
the children list.

Reproducer:
A generated C reproducer was not produced for this seed. The syz
program is attached as reproducer.syz; the salient operation sequence
is:

  1. mkdir + mount configfs
  2. openat the null_blk backend ("nullb")
  3. mkdirat a new config item under nullb
  4. openat one of its attributes with fault injection (fail_nth=7),
     which takes the dput()/RCU-free path on the freshly-allocated
     dentry
  5. additional openat + write syscalls (incidental to the race)
  6. rmdir the config item, which reaches configfs_drop_dentry()
     before the RCU grace period for step 4's freed dentry has
     elapsed

The console report is attached as crash-report.txt.

Novelty check:
I searched syzbot dashboard data across upstream, fixed, invalid, stable,
and Android namespaces, and searched lore.kernel.org for
"configfs_drop_dentry", "detach_attrs" + "UAF", and "configfs_rmdir" +
"KASAN". I did not find an exact match. There are unrelated configfs
default-group / PCI-endpoint race reports, but those have different
code paths and free sites.

I appreciate your time and consideration, and I'm grateful for your
work on this subsystem. I'd be glad to test any candidate patches.

Regards,

[-- Attachment #2: crash-report.txt --]
[-- Type: text/plain, Size: 9055 bytes --]

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f48fd005fa0 R14: 00007f48fd005fa0 R15: 0000000000001185
 </TASK>
==================================================================
BUG: KASAN: slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x33/0x40 kernel/locking/spinlock.c:154
Read of size 1 at addr ffff888133d5a538 by task syz.2.275/4076

CPU: 1 UID: 0 PID: 4076 Comm: syz.2.275 Not tainted 6.17.8 #1 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x1a9/0x280 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xba/0x230 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568
 kasan_check_byte include/linux/kasan.h:399 [inline]
 lock_acquire+0x8d/0x350 kernel/locking/lockdep.c:5842
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x33/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 configfs_drop_dentry+0x5c/0x150 fs/configfs/inode.c:209
 detach_attrs+0x22b/0x2f0 fs/configfs/dir.c:588
 configfs_detach_item fs/configfs/dir.c:870 [inline]
 configfs_detach_group fs/configfs/dir.c:917 [inline]
 configfs_rmdir+0x652/0x9f0 fs/configfs/dir.c:1551
 vfs_rmdir+0x3c2/0x530 fs/namei.c:4469
 do_rmdir+0x275/0x540 fs/namei.c:4524
 __do_sys_rmdir fs/namei.c:4543 [inline]
 __se_sys_rmdir fs/namei.c:4541 [inline]
 __x64_sys_rmdir+0x4c/0x60 fs/namei.c:4541
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf0/0x390 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48fcd7778d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffbceab7a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 00007f48fd005fa0 RCX: 00007f48fcd7778d
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000002c0
RBP: 00007f48fce1eb3d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48fd005fa0 R14: 00007f48fd005fa0 R15: 0000000000001677
 </TASK>

Allocated by task 4076:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:330 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:356
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4206 [inline]
 slab_alloc_node mm/slub.c:4255 [inline]
 kmem_cache_alloc_lru_noprof+0x1c2/0x3b0 mm/slub.c:4274
 __d_alloc+0x3b/0x7b0 fs/dcache.c:1690
 d_alloc_parallel+0xeb/0x1620 fs/dcache.c:2549
 lookup_open fs/namei.c:3638 [inline]
 open_last_lookups fs/namei.c:3815 [inline]
 path_openat+0xa6b/0x3890 fs/namei.c:4051
 do_filp_open+0x232/0x490 fs/namei.c:4081
 do_sys_openat2+0x134/0x1e0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x13d/0x170 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf0/0x390 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 15:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:243 [inline]
 __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2437 [inline]
 slab_free mm/slub.c:4710 [inline]
 kmem_cache_free+0x18f/0x3f0 mm/slub.c:4812
 rcu_do_batch kernel/rcu/tree.c:2605 [inline]
 rcu_core+0xd1e/0x1800 kernel/rcu/tree.c:2861
 handle_softirqs+0x278/0x870 kernel/softirq.c:579
 run_ksoftirqd+0xac/0x110 kernel/softirq.c:968
 smpboot_thread_fn+0x546/0xa50 kernel/smpboot.c:160
 kthread+0x728/0x8b0 kernel/kthread.c:463
 ret_from_fork+0x452/0x7d0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
 __call_rcu_common kernel/rcu/tree.c:3123 [inline]
 call_rcu+0x157/0x9e0 kernel/rcu/tree.c:3243
 __dentry_kill+0x4d7/0x660 fs/dcache.c:688
 dput+0x1a4/0x2b0 fs/dcache.c:911
 lookup_open fs/namei.c:3728 [inline]
 open_last_lookups fs/namei.c:3815 [inline]
 path_openat+0x1536/0x3890 fs/namei.c:4051
 do_filp_open+0x232/0x490 fs/namei.c:4081
 do_sys_openat2+0x134/0x1e0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x13d/0x170 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf0/0x390 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888133d5a468
 which belongs to the cache dentry of size 312
The buggy address is located 208 bytes inside of
 freed 312-byte region [ffff888133d5a468, ffff888133d5a5a0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x133d5a
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888137c44901
flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff8881016a6640 ffffea0004955500 dead000000000002
raw: 0000000000000000 0000000080150015 00000000f5000000 ffff888137c44901
head: 0200000000000040 ffff8881016a6640 ffffea0004955500 dead000000000002
head: 0000000000000000 0000000080150015 00000000f5000000 ffff888137c44901
head: 0200000000000001 ffffea0004cf5681 00000000ffffffff 00000000ffffffff
head: 00000007f014aaa9 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3263, tgid 3263 ((udev-worker)), ts 66383627308, free_ts 59690661564
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x234/0x280 mm/page_alloc.c:1851
 prep_new_page mm/page_alloc.c:1859 [inline]
 get_page_from_freelist+0x2124/0x2290 mm/page_alloc.c:3858
 __alloc_frozen_pages_noprof+0x192/0x380 mm/page_alloc.c:5148
 alloc_pages_mpol+0xd6/0x330 mm/mempolicy.c:2416
 alloc_slab_page mm/slub.c:2507 [inline]
 allocate_slab+0x8f/0x320 mm/slub.c:2675
 new_slab mm/slub.c:2729 [inline]
 ___slab_alloc+0xbdc/0x1400 mm/slub.c:3916
 __slab_alloc mm/slub.c:4007 [inline]
 __slab_alloc_node mm/slub.c:4082 [inline]
 slab_alloc_node mm/slub.c:4243 [inline]
 kmem_cache_alloc_lru_noprof+0x280/0x3b0 mm/slub.c:4274
 __d_alloc+0x3b/0x7b0 fs/dcache.c:1690
 d_alloc_parallel+0xeb/0x1620 fs/dcache.c:2549
 __lookup_slow+0x13c/0x420 fs/namei.c:1801
 lookup_slow+0x58/0x80 fs/namei.c:1833
 walk_component+0x2d7/0x410 fs/namei.c:2137
 lookup_last fs/namei.c:2638 [inline]
 path_lookupat+0x168/0x440 fs/namei.c:2662
 filename_lookup+0x25b/0x5d0 fs/namei.c:2691
 vfs_statx+0x11a/0x570 fs/stat.c:353
 vfs_fstatat+0x11d/0x170 fs/stat.c:375
page last free pid 2546 tgid 2546 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 free_unref_folios+0xca1/0x1390 mm/page_alloc.c:2952
 folios_put_refs+0x46f/0x560 mm/swap.c:999
 free_pages_and_swap_cache+0x2ec/0x5b0 mm/swap_state.c:264
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
 tlb_flush_mmu+0x3ab/0x690 mm/mmu_gather.c:404
 tlb_finish_mmu+0xc8/0x1d0 mm/mmu_gather.c:497
 vms_clear_ptes+0x45a/0x580 mm/vma.c:1235
 vms_complete_munmap_vmas+0x20a/0x890 mm/vma.c:1277
 do_vmi_align_munmap+0x3a7/0x490 mm/vma.c:1536
 do_vmi_munmap+0x257/0x2e0 mm/vma.c:1584
 __vm_munmap+0x270/0x400 mm/vma.c:3155
 __do_sys_munmap mm/mmap.c:1080 [inline]
 __se_sys_munmap mm/mmap.c:1077 [inline]
 __x64_sys_munmap+0x65/0x80 mm/mmap.c:1077
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf0/0x390 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888133d5a400: 00 00 00 00 00 fc fc fc fc fc fc fc fc fa fb fb
 ffff888133d5a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888133d5a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff888133d5a580: fb fb fb fb fc fc fc fc fc fc fc fc 00 00 00 00
 ffff888133d5a600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

[-- Attachment #3: reproducer.syz --]
[-- Type: application/octet-stream, Size: 923 bytes --]

# {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
mkdir(&(0x7f0000000040)='./pm242cfg\x00', 0x0)
mount(0x0, &(0x7f0000000080)='./pm242cfg\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./pm242cfg/nullb\x00', 0x0, 0x0)
mkdirat(r0, &(0x7f0000000140)='pm242rel\x00', 0x0)
openat(r0, &(0x7f00000001c0)='pm242rel/memory_backed\x00', 0x1, 0x0) (fail_nth: 7)
r1 = openat(r0, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000280)='1\n', 0x2)
rmdir(&(0x7f00000002c0)='./pm242cfg/nullb/pm242rel')

Re: [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir

[Breno Leitao]

On Tue, May 26, 2026 at 08:42:00PM +0000, Farhad Alemi wrote:
> Hello Andreas and the configfs team,
> 
> I am reporting a configfs use-after-free found by syzkaller.
> 
> Summary:
> A configfs config-item rmdir(2) can land in configfs_drop_dentry() with
> sd->s_dentry pointing at a dentry whose RCU grace period has not yet
> elapsed. The spin_lock(&dentry->d_lock) at fs/configfs/inode.c:209 then
> reads freed slab memory and KASAN reports a slab-use-after-free.

Thanks for the report. I was able to reproduce it on linus' upstream
tree. 

I've came up with the following fix, would you mind trying it, please?


commit d78c04736ef0ede76093c780a188560b6baed3c3
Author: Breno Leitao <leitao@debian.org>
Date:   Wed May 27 06:25:49 2026 -0400

    configfs: fix UAF in configfs_drop_dentry() after failed attribute lookup
    
    When configfs_lookup() matches an attribute it publishes the new dentry
    into sd->s_dentry (and dentry->d_fsdata) before calling
    configfs_create() to allocate the inode:
    
            dentry->d_fsdata = configfs_get(sd);
            sd->s_dentry = dentry;
            spin_unlock(&configfs_dirent_lock);
    
            inode = configfs_create(dentry, mode);
            if (IS_ERR(inode)) {
                    configfs_put(sd);
                    return ERR_CAST(inode);
            }
    
    If configfs_create() fails (e.g. new_inode() returns NULL under memory
    pressure or fault injection), the lookup returns an error and the
    caller dputs the now-negative dentry, which goes through
    __dentry_kill() and is freed via call_rcu().
    
    Because the dentry never gained an inode it does not go through the
    .d_iput op (configfs_d_iput), which is the only place that clears
    sd->s_dentry.  sd therefore keeps a stale pointer to the freed dentry.
    A subsequent rmdir of the parent item walks the parent's s_children
    list in detach_attrs() and configfs_drop_dentry() does
    spin_lock(&sd->s_dentry->d_lock) on freed memory:
    
      BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x110
      Read of size 1 at addr ffff00012bacd028 by task repro/2440
       _raw_spin_lock+0xac/0x110
       configfs_drop_dentry+0x48/0x158 [configfs]
       detach_attrs.isra.0+0x18c/0x494 [configfs]
       configfs_rmdir+0x450/0x71c [configfs]
       vfs_rmdir+0x170/0x620
       ...
      Freed by task 0:
       __d_free+0x28/0x34
       rcu_do_batch+0x37c/0x1bd0
       ...
      Last potentially related work creation:
       call_rcu+0x34/0x68
       dentry_free+0xe8/0x3e0
       __dentry_kill+0x404/0x604
       dput+0x14/0x30
       lookup_open.isra.0+0x6ac/0xc00
       path_openat+0xd18/0x2588
    
    Fix this by tearing down the sd<->dentry linkage in the
    configfs_create() error path, under configfs_dirent_lock, mirroring
    what configfs_d_iput() would have done for a positive dentry.
    
    Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
    Signed-off-by: Breno Leitao <leitao@debian.org>

diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 362b6ff9b908..68d857dcb2d9 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -486,6 +486,22 @@ static struct dentry * configfs_lookup(struct inode *dir,
 
 			inode = configfs_create(dentry, mode);
 			if (IS_ERR(inode)) {
+				/*
+				 * configfs_create() failed (e.g. -ENOMEM
+				 * from new_inode()).  The dentry will be
+				 * dput()ed by the caller and freed via RCU;
+				 * because it never gained an inode,
+				 * configfs_d_iput() will not run to clear
+				 * sd->s_dentry.  Drop the linkage here so a
+				 * later detach_attrs() walking the parent's
+				 * s_children list does not dereference a
+				 * freed dentry in configfs_drop_dentry().
+				 */
+				spin_lock(&configfs_dirent_lock);
+				if (sd->s_dentry == dentry)
+					sd->s_dentry = NULL;
+				dentry->d_fsdata = NULL;
+				spin_unlock(&configfs_dirent_lock);
 				configfs_put(sd);
 				return ERR_CAST(inode);
 			}

Re: [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir

[Farhad Alemi]

[-- Attachment #1: Type: text/plain, Size: 5253 bytes --]

Hi Breno,

Thanks for sending the patch. I applied your patch on top of v7.1-rc5
e7ae89a0c97ce2b68b0983cd01eda67cf373517d and rebuilt with the same
config that originally caught this. The attached reproducer now runs
without causing a panic. Without the patch, the same reproducer still
trips it.

Please feel free to add:
    Tested-by: Farhad Alemi <farhad.alemi@berkeley.edu>

Thanks again,

On Wed, May 27, 2026 at 3:27 AM Breno Leitao <leitao@debian.org> wrote:
>
> On Tue, May 26, 2026 at 08:42:00PM +0000, Farhad Alemi wrote:
> > Hello Andreas and the configfs team,
> >
> > I am reporting a configfs use-after-free found by syzkaller.
> >
> > Summary:
> > A configfs config-item rmdir(2) can land in configfs_drop_dentry() with
> > sd->s_dentry pointing at a dentry whose RCU grace period has not yet
> > elapsed. The spin_lock(&dentry->d_lock) at fs/configfs/inode.c:209 then
> > reads freed slab memory and KASAN reports a slab-use-after-free.
>
> Thanks for the report. I was able to reproduce it on linus' upstream
> tree.
>
> I've came up with the following fix, would you mind trying it, please?
>
>
> commit d78c04736ef0ede76093c780a188560b6baed3c3
> Author: Breno Leitao <leitao@debian.org>
> Date:   Wed May 27 06:25:49 2026 -0400
>
>     configfs: fix UAF in configfs_drop_dentry() after failed attribute lookup
>
>     When configfs_lookup() matches an attribute it publishes the new dentry
>     into sd->s_dentry (and dentry->d_fsdata) before calling
>     configfs_create() to allocate the inode:
>
>             dentry->d_fsdata = configfs_get(sd);
>             sd->s_dentry = dentry;
>             spin_unlock(&configfs_dirent_lock);
>
>             inode = configfs_create(dentry, mode);
>             if (IS_ERR(inode)) {
>                     configfs_put(sd);
>                     return ERR_CAST(inode);
>             }
>
>     If configfs_create() fails (e.g. new_inode() returns NULL under memory
>     pressure or fault injection), the lookup returns an error and the
>     caller dputs the now-negative dentry, which goes through
>     __dentry_kill() and is freed via call_rcu().
>
>     Because the dentry never gained an inode it does not go through the
>     .d_iput op (configfs_d_iput), which is the only place that clears
>     sd->s_dentry.  sd therefore keeps a stale pointer to the freed dentry.
>     A subsequent rmdir of the parent item walks the parent's s_children
>     list in detach_attrs() and configfs_drop_dentry() does
>     spin_lock(&sd->s_dentry->d_lock) on freed memory:
>
>       BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x110
>       Read of size 1 at addr ffff00012bacd028 by task repro/2440
>        _raw_spin_lock+0xac/0x110
>        configfs_drop_dentry+0x48/0x158 [configfs]
>        detach_attrs.isra.0+0x18c/0x494 [configfs]
>        configfs_rmdir+0x450/0x71c [configfs]
>        vfs_rmdir+0x170/0x620
>        ...
>       Freed by task 0:
>        __d_free+0x28/0x34
>        rcu_do_batch+0x37c/0x1bd0
>        ...
>       Last potentially related work creation:
>        call_rcu+0x34/0x68
>        dentry_free+0xe8/0x3e0
>        __dentry_kill+0x404/0x604
>        dput+0x14/0x30
>        lookup_open.isra.0+0x6ac/0xc00
>        path_openat+0xd18/0x2588
>
>     Fix this by tearing down the sd<->dentry linkage in the
>     configfs_create() error path, under configfs_dirent_lock, mirroring
>     what configfs_d_iput() would have done for a positive dentry.
>
>     Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
>     Signed-off-by: Breno Leitao <leitao@debian.org>
>
> diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
> index 362b6ff9b908..68d857dcb2d9 100644
> --- a/fs/configfs/dir.c
> +++ b/fs/configfs/dir.c
> @@ -486,6 +486,22 @@ static struct dentry * configfs_lookup(struct inode *dir,
>
>                         inode = configfs_create(dentry, mode);
>                         if (IS_ERR(inode)) {
> +                               /*
> +                                * configfs_create() failed (e.g. -ENOMEM
> +                                * from new_inode()).  The dentry will be
> +                                * dput()ed by the caller and freed via RCU;
> +                                * because it never gained an inode,
> +                                * configfs_d_iput() will not run to clear
> +                                * sd->s_dentry.  Drop the linkage here so a
> +                                * later detach_attrs() walking the parent's
> +                                * s_children list does not dereference a
> +                                * freed dentry in configfs_drop_dentry().
> +                                */
> +                               spin_lock(&configfs_dirent_lock);
> +                               if (sd->s_dentry == dentry)
> +                                       sd->s_dentry = NULL;
> +                               dentry->d_fsdata = NULL;
> +                               spin_unlock(&configfs_dirent_lock);
>                                 configfs_put(sd);
>                                 return ERR_CAST(inode);
>                         }

[-- Attachment #2: reproducer.c --]
[-- Type: application/octet-stream, Size: 17728 bytes --]

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/capability.h>

static __thread int clone_ongoing;
static __thread int skip_segv;
static __thread jmp_buf segv_env;

static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
  if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
    exit(sig);
  }
  uintptr_t addr = (uintptr_t)info->si_addr;
  const uintptr_t prog_start = 1 << 20;
  const uintptr_t prog_end = 100 << 20;
  int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
  int valid = addr < prog_start || addr > prog_end;
  if (skip && valid) {
    _longjmp(segv_env, 1);
  }
  exit(sig);
}

static void install_segv_handler(void)
{
  struct sigaction sa;
  memset(&sa, 0, sizeof(sa));
  sa.sa_handler = SIG_IGN;
  syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8);
  syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8);
  memset(&sa, 0, sizeof(sa));
  sa.sa_sigaction = segv_handler;
  sa.sa_flags = SA_NODEFER | SA_SIGINFO;
  sigaction(SIGSEGV, &sa, NULL);
  sigaction(SIGBUS, &sa, NULL);
}

#define NONFAILING(...)                                                        \
  ({                                                                           \
    int ok = 1;                                                                \
    __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
    if (_setjmp(segv_env) == 0) {                                              \
      __VA_ARGS__;                                                             \
    } else                                                                     \
      ok = 0;                                                                  \
    __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
    ok;                                                                        \
  })

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void use_temporary_dir(void)
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    exit(1);
  if (chmod(tmpdir, 0777))
    exit(1);
  if (chdir(tmpdir))
    exit(1);
}

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

static void setup_gadgetfs();
static void setup_binderfs();
static void setup_fusectl();
static void sandbox_common_mount_tmpfs(void)
{
  write_file("/proc/sys/fs/mount-max", "100000");
  if (mkdir("./syz-tmp", 0777))
    exit(1);
  if (mount("", "./syz-tmp", "tmpfs", 0, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot", 0777))
    exit(1);
  if (mkdir("./syz-tmp/newroot/dev", 0700))
    exit(1);
  unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE;
  if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot/proc", 0700))
    exit(1);
  if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot/selinux", 0700))
    exit(1);
  const char* selinux_path = "./syz-tmp/newroot/selinux";
  if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) {
    if (errno != ENOENT)
      exit(1);
    if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) &&
        errno != ENOENT)
      exit(1);
  }
  if (mkdir("./syz-tmp/newroot/sys", 0700))
    exit(1);
  if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL))
    exit(1);
  if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL,
            bind_mount_flags, NULL) &&
      errno != ENOENT)
    exit(1);
  if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL,
            bind_mount_flags, NULL) &&
      errno != ENOENT)
    exit(1);
  if (mount("/proc/sys/fs/binfmt_misc",
            "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags,
            NULL) &&
      errno != ENOENT)
    exit(1);
  if (mkdir("./syz-tmp/newroot/syz-inputs", 0700))
    exit(1);
  if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL,
            bind_mount_flags | MS_RDONLY, NULL) &&
      errno != ENOENT)
    exit(1);
  if (mkdir("./syz-tmp/pivot", 0777))
    exit(1);
  if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) {
    if (chdir("./syz-tmp"))
      exit(1);
  } else {
    if (chdir("/"))
      exit(1);
    if (umount2("./pivot", MNT_DETACH))
      exit(1);
  }
  if (chroot("./newroot"))
    exit(1);
  if (chdir("/"))
    exit(1);
  setup_gadgetfs();
  setup_binderfs();
  setup_fusectl();
}

static void setup_gadgetfs()
{
  if (mkdir("/dev/gadgetfs", 0777)) {
  }
  if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) {
  }
}

static void setup_fusectl()
{
  if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
  }
}

static void setup_binderfs()
{
  if (mkdir("/dev/binderfs", 0777)) {
  }
  if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
  }
}

static void loop();

static void sandbox_common()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  if (getppid() == 1)
    exit(1);
  struct rlimit rlim;
  rlim.rlim_cur = rlim.rlim_max = (200 << 20);
  setrlimit(RLIMIT_AS, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 32 << 20;
  setrlimit(RLIMIT_MEMLOCK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 136 << 20;
  setrlimit(RLIMIT_FSIZE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
  setrlimit(RLIMIT_STACK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 128 << 20;
  setrlimit(RLIMIT_CORE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 256;
  setrlimit(RLIMIT_NOFILE, &rlim);
  if (unshare(CLONE_NEWNS)) {
  }
  if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
  }
  if (unshare(CLONE_NEWIPC)) {
  }
  if (unshare(0x02000000)) {
  }
  if (unshare(CLONE_NEWUTS)) {
  }
  if (unshare(CLONE_SYSVSEM)) {
  }
  typedef struct {
    const char* name;
    const char* value;
  } sysctl_t;
  static const sysctl_t sysctls[] = {
      {"/proc/sys/kernel/shmmax", "16777216"},
      {"/proc/sys/kernel/shmall", "536870912"},
      {"/proc/sys/kernel/shmmni", "1024"},
      {"/proc/sys/kernel/msgmax", "8192"},
      {"/proc/sys/kernel/msgmni", "1024"},
      {"/proc/sys/kernel/msgmnb", "1024"},
      {"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
  };
  unsigned i;
  for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
    write_file(sysctls[i].name, sysctls[i].value);
}

static int wait_for_loop(int pid)
{
  if (pid < 0)
    exit(1);
  int status = 0;
  while (waitpid(-1, &status, __WALL) != pid) {
  }
  return WEXITSTATUS(status);
}

static void drop_caps(void)
{
  struct __user_cap_header_struct cap_hdr = {};
  struct __user_cap_data_struct cap_data[2] = {};
  cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
  cap_hdr.pid = getpid();
  if (syscall(SYS_capget, &cap_hdr, &cap_data))
    exit(1);
  const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
  cap_data[0].effective &= ~drop;
  cap_data[0].permitted &= ~drop;
  cap_data[0].inheritable &= ~drop;
  if (syscall(SYS_capset, &cap_hdr, &cap_data))
    exit(1);
}

static int do_sandbox_none(void)
{
  if (unshare(CLONE_NEWPID)) {
  }
  int pid = fork();
  if (pid != 0)
    return wait_for_loop(pid);
  sandbox_common();
  drop_caps();
  if (unshare(CLONE_NEWNET)) {
  }
  write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
  sandbox_common_mount_tmpfs();
  loop();
  exit(1);
}

#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
  int iter = 0;
  DIR* dp = 0;
  const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW;

retry:
  while (umount2(dir, umount_flags) == 0) {
  }
  dp = opendir(dir);
  if (dp == NULL) {
    if (errno == EMFILE) {
      exit(1);
    }
    exit(1);
  }
  struct dirent* ep = 0;
  while ((ep = readdir(dp))) {
    if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
      continue;
    char filename[FILENAME_MAX];
    snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
    while (umount2(filename, umount_flags) == 0) {
    }
    struct stat st;
    if (lstat(filename, &st))
      exit(1);
    if (S_ISDIR(st.st_mode)) {
      remove_dir(filename);
      continue;
    }
    int i;
    for (i = 0;; i++) {
      if (unlink(filename) == 0)
        break;
      if (errno == EPERM) {
        int fd = open(filename, O_RDONLY);
        if (fd != -1) {
          long flags = 0;
          if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
          }
          close(fd);
          continue;
        }
      }
      if (errno == EROFS) {
        break;
      }
      if (errno != EBUSY || i > 100)
        exit(1);
      if (umount2(filename, umount_flags))
        exit(1);
    }
  }
  closedir(dp);
  for (int i = 0;; i++) {
    if (rmdir(dir) == 0)
      break;
    if (i < 100) {
      if (errno == EPERM) {
        int fd = open(dir, O_RDONLY);
        if (fd != -1) {
          long flags = 0;
          if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
          }
          close(fd);
          continue;
        }
      }
      if (errno == EROFS) {
        break;
      }
      if (errno == EBUSY) {
        if (umount2(dir, umount_flags))
          exit(1);
        continue;
      }
      if (errno == ENOTEMPTY) {
        if (iter < 100) {
          iter++;
          goto retry;
        }
      }
    }
    exit(1);
  }
}

static int inject_fault(int nth)
{
  int fd;
  fd = open("/proc/thread-self/fail-nth", O_RDWR);
  if (fd == -1)
    exit(1);
  char buf[16];
  sprintf(buf, "%d", nth);
  if (write(fd, buf, strlen(buf)) != (ssize_t)strlen(buf))
    exit(1);
  return fd;
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  write_file("/proc/self/oom_score_adj", "1000");
  if (symlink("/dev/binderfs", "./binderfs")) {
  }
}

static const char* setup_fault()
{
  int fd = open("/proc/self/make-it-fail", O_WRONLY);
  if (fd == -1)
    return "CONFIG_FAULT_INJECTION is not enabled";
  close(fd);
  fd = open("/proc/thread-self/fail-nth", O_WRONLY);
  if (fd == -1)
    return "kernel does not have systematic fault injection support";
  close(fd);
  static struct {
    const char* file;
    const char* val;
    bool fatal;
  } files[] = {
      {"/sys/kernel/debug/failslab/ignore-gfp-wait", "N", true},
      {"/sys/kernel/debug/fail_futex/ignore-private", "N", false},
      {"/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", "N", false},
      {"/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N", false},
      {"/sys/kernel/debug/fail_page_alloc/min-order", "0", false},
  };
  unsigned i;
  for (i = 0; i < sizeof(files) / sizeof(files[0]); i++) {
    if (!write_file(files[i].file, files[i].val)) {
      if (files[i].fatal)
        return "failed to write fault injection file";
    }
  }
  return NULL;
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  int iter = 0;
  for (;; iter++) {
    char cwdbuf[32];
    sprintf(cwdbuf, "./%d", iter);
    if (mkdir(cwdbuf, 0777))
      exit(1);
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      if (chdir(cwdbuf))
        exit(1);
      setup_test();
      execute_one();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
    remove_dir(cwdbuf);
  }
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

void execute_one(void)
{
  intptr_t res = 0;
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  mkdir arguments: [
  //    path: ptr[in, buffer] {
  //      buffer: {2e 2f 70 6d 32 34 32 63 66 67 00} (length 0xb)
  //    }
  //    mode: open_mode = 0x0 (8 bytes)
  //  ]
  NONFAILING(memcpy((void*)0x200000000040, "./pm242cfg\000", 11));
  syscall(__NR_mkdir, /*path=*/0x200000000040ul, /*mode=*/0ul);
  //  mount arguments: [
  //    src: nil
  //    dst: ptr[in, buffer] {
  //      buffer: {2e 2f 70 6d 32 34 32 63 66 67 00} (length 0xb)
  //    }
  //    type: ptr[in, buffer] {
  //      buffer: {63 6f 6e 66 69 67 66 73 00} (length 0x9)
  //    }
  //    flags: mount_flags = 0x0 (8 bytes)
  //    data: nil
  //  ]
  NONFAILING(memcpy((void*)0x200000000080, "./pm242cfg\000", 11));
  NONFAILING(memcpy((void*)0x2000000000c0, "configfs\000", 9));
  syscall(__NR_mount, /*src=*/0ul, /*dst=*/0x200000000080ul,
          /*type=*/0x2000000000c0ul, /*flags=*/0ul, /*data=*/0ul);
  //  openat$dir arguments: [
  //    fd: const = 0xffffffffffffff9c (8 bytes)
  //    file: ptr[in, buffer] {
  //      buffer: {2e 2f 70 6d 32 34 32 63 66 67 2f 6e 75 6c 6c 62 00} (length
  //      0x11)
  //    }
  //    flags: open_flags = 0x0 (4 bytes)
  //    mode: open_mode = 0x0 (2 bytes)
  //  ]
  //  returns fd_dir
  NONFAILING(memcpy((void*)0x200000000100, "./pm242cfg/nullb\000", 17));
  res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul,
                /*file=*/0x200000000100ul, /*flags=*/0, /*mode=*/0);
  if (res != -1)
    r[0] = res;
  //  mkdirat arguments: [
  //    fd: fd_dir (resource)
  //    path: ptr[in, buffer] {
  //      buffer: {70 6d 32 34 32 72 65 6c 00} (length 0x9)
  //    }
  //    mode: open_mode = 0x0 (8 bytes)
  //  ]
  NONFAILING(memcpy((void*)0x200000000140, "pm242rel\000", 9));
  syscall(__NR_mkdirat, /*fd=*/r[0], /*path=*/0x200000000140ul, /*mode=*/0ul);
  //  openat arguments: [
  //    fd: fd_dir (resource)
  //    file: ptr[in, buffer] {
  //      buffer: {70 6d 32 34 32 72 65 6c 2f 6d 65 6d 6f 72 79 5f 62 61 63 6b
  //      65 64 00} (length 0x17)
  //    }
  //    flags: open_flags = 0x1 (4 bytes)
  //    mode: open_mode = 0x0 (2 bytes)
  //  ]
  //  returns fd
  NONFAILING(memcpy((void*)0x2000000001c0, "pm242rel/memory_backed\000", 23));
  inject_fault(7);
  syscall(__NR_openat, /*fd=*/r[0], /*file=*/0x2000000001c0ul,
          /*flags=O_WRONLY*/ 1, /*mode=*/0);
  //  openat arguments: [
  //    fd: fd_dir (resource)
  //    file: nil
  //    flags: open_flags = 0x1 (4 bytes)
  //    mode: open_mode = 0x0 (2 bytes)
  //  ]
  //  returns fd
  res = syscall(__NR_openat, /*fd=*/r[0], /*file=*/0ul, /*flags=O_WRONLY*/ 1,
                /*mode=*/0);
  if (res != -1)
    r[1] = res;
  //  write arguments: [
  //    fd: fd (resource)
  //    buf: ptr[in, buffer] {
  //      buffer: {31 0a} (length 0x2)
  //    }
  //    count: len = 0x2 (8 bytes)
  //  ]
  NONFAILING(memcpy((void*)0x200000000280, "1\n", 2));
  syscall(__NR_write, /*fd=*/r[1], /*buf=*/0x200000000280ul, /*count=*/2ul);
  //  rmdir arguments: [
  //    path: ptr[in, buffer] {
  //      buffer: {2e 2f 70 6d 32 34 32 63 66 67 2f 6e 75 6c 6c 62 2f 70 6d 32
  //      34 32 72 65 6c} (length 0x19)
  //    }
  //  ]
  NONFAILING(memcpy((void*)0x2000000002c0, "./pm242cfg/nullb/pm242rel", 25));
  syscall(__NR_rmdir, /*path=*/0x2000000002c0ul);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  const char* reason;
  (void)reason;
  if ((reason = setup_fault()))
    printf("the reproducer may not work as expected: fault injection setup "
           "failed: %s\n",
           reason);
  install_segv_handler();
  use_temporary_dir();
  do_sandbox_none();
  return 0;
}

Re: [BUG] configfs: slab-use-after-free in configfs_drop_dentry() on rmdir

[Al Viro]

On Wed, May 27, 2026 at 11:27:57AM +0100, Breno Leitao wrote:
> +				/*
> +				 * configfs_create() failed (e.g. -ENOMEM
> +				 * from new_inode()).  The dentry will be
> +				 * dput()ed by the caller and freed via RCU;
> +				 * because it never gained an inode,
> +				 * configfs_d_iput() will not run to clear
> +				 * sd->s_dentry.  Drop the linkage here so a
> +				 * later detach_attrs() walking the parent's
> +				 * s_children list does not dereference a
> +				 * freed dentry in configfs_drop_dentry().
> +				 */
> +				spin_lock(&configfs_dirent_lock);
> +				if (sd->s_dentry == dentry)

Don't need that comparison - to get a different ->s_dentry you'd need a lookup
on the same name in the same parent since having dropped configfs_dirent_lock,
and VFS locking guarantees that it won't happen.

IOW, the variant in
https://lore.kernel.org/all/20260519070633.2025485-2-viro@zeniv.linux.org.uk/
should be fine.